CVE-2026-56718
High
Description
AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters.
SeverityHigh
CVSS7.5
Exploit probability—
ProductAJY IPC Firmware
PublishedAug 30, 2026
First seenAug 30, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- AJCloud AJY IPC Firmware01.10715.11.37 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| AJCloud AJY IPC Firmware | v < 01.10715.11.37 | 01.10715.11.37 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.